quasar | ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682

Resubmissions

17-01-2025 19:13

250117-xxlcdszpbv 10

17-01-2025 19:09

250117-xt892sznbw 10

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiscordXploit.exe
Size

3.3MB
MD5

95da0645204d22bd9daf4e337ebeeaaa
SHA1

58182d8cf8e83335a5b7312d0d4af79f4bd64212
SHA256

ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682
SHA512

9257076c55b3cc6100f3299766bf7bf0be1e0b330c1cadca1d7ca46ff859e4afefeff3635fc15811cc2c7d6debd2fcb808cf5f96314c681b1dbc32d2a7305f9e
SSDEEP

49152:jv2lL26AaNeWgPhlmVqvMQ7XSK2BVOzho9vJxOoGdzTHHB72eh2NTsd:jv2L26AaNeWgPhlmVqkQ7XSKS8oond

Score

10^/10

quasar client0001 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

client0001

hxp7-48924.portmap.host:48924

Mutex

dfda6d3b-23ed-4a2b-b0c4-4361d434ec5c

Attributes

encryption_key
0F17464091E1835B99CC4D3E93D8043B9AE2FAF4
install_name
Windows-Graphics-Loader.exe
log_directory
Logs
reconnect_delay
10000
startup_key
Windows Graphics Loader
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3500-1-0x0000000000EE0000-0x0000000001228000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023cb8-5.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe

Executes dropped EXE 14 IoCs

pid	Process
4516	Windows-Graphics-Loader.exe
3080	Windows-Graphics-Loader.exe
804	Windows-Graphics-Loader.exe
3924	Windows-Graphics-Loader.exe
3856	Windows-Graphics-Loader.exe
4256	Windows-Graphics-Loader.exe
3820	Windows-Graphics-Loader.exe
4684	Windows-Graphics-Loader.exe
1480	Windows-Graphics-Loader.exe
5064	Windows-Graphics-Loader.exe
3724	Windows-Graphics-Loader.exe
2040	Windows-Graphics-Loader.exe
1996	Windows-Graphics-Loader.exe
1752	Windows-Graphics-Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2008	PING.EXE
1824	PING.EXE
3468	PING.EXE
4768	PING.EXE
1240	PING.EXE
3532	PING.EXE
1760	PING.EXE
2504	PING.EXE
4968	PING.EXE
5048	PING.EXE
396	PING.EXE
5084	PING.EXE
1700	PING.EXE
1240	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
4768	PING.EXE
1240	PING.EXE
1824	PING.EXE
3468	PING.EXE
1760	PING.EXE
5048	PING.EXE
4968	PING.EXE
1700	PING.EXE
2504	PING.EXE
1240	PING.EXE
3532	PING.EXE
2008	PING.EXE
5084	PING.EXE
396	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
692	schtasks.exe
444	schtasks.exe
404	schtasks.exe
4256	schtasks.exe
3272	schtasks.exe
1720	schtasks.exe
1460	schtasks.exe
1456	schtasks.exe
3792	schtasks.exe
4816	schtasks.exe
1772	schtasks.exe
3100	schtasks.exe
2920	schtasks.exe
4980	schtasks.exe
4928	schtasks.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	DiscordXploit.exe
Token: SeDebugPrivilege	4516	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3080	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	804	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3924	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3856	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	4256	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3820	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	4684	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1480	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	5064	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3724	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2040	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1996	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1752	Windows-Graphics-Loader.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
4516	Windows-Graphics-Loader.exe
3080	Windows-Graphics-Loader.exe
804	Windows-Graphics-Loader.exe
3924	Windows-Graphics-Loader.exe
3856	Windows-Graphics-Loader.exe
4256	Windows-Graphics-Loader.exe
3820	Windows-Graphics-Loader.exe
4684	Windows-Graphics-Loader.exe
1480	Windows-Graphics-Loader.exe
5064	Windows-Graphics-Loader.exe
3724	Windows-Graphics-Loader.exe
2040	Windows-Graphics-Loader.exe
1996	Windows-Graphics-Loader.exe
1752	Windows-Graphics-Loader.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
4516	Windows-Graphics-Loader.exe
3080	Windows-Graphics-Loader.exe
804	Windows-Graphics-Loader.exe
3924	Windows-Graphics-Loader.exe
3856	Windows-Graphics-Loader.exe
4256	Windows-Graphics-Loader.exe
3820	Windows-Graphics-Loader.exe
4684	Windows-Graphics-Loader.exe
1480	Windows-Graphics-Loader.exe
5064	Windows-Graphics-Loader.exe
3724	Windows-Graphics-Loader.exe
2040	Windows-Graphics-Loader.exe
1996	Windows-Graphics-Loader.exe
1752	Windows-Graphics-Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 3100	3500	DiscordXploit.exe	84
PID 3500 wrote to memory of 3100	3500	DiscordXploit.exe	84
PID 3500 wrote to memory of 4516	3500	DiscordXploit.exe	86
PID 3500 wrote to memory of 4516	3500	DiscordXploit.exe	86
PID 4516 wrote to memory of 4256	4516	Windows-Graphics-Loader.exe	87
PID 4516 wrote to memory of 4256	4516	Windows-Graphics-Loader.exe	87
PID 4516 wrote to memory of 216	4516	Windows-Graphics-Loader.exe	89
PID 4516 wrote to memory of 216	4516	Windows-Graphics-Loader.exe	89
PID 216 wrote to memory of 2320	216	cmd.exe	91
PID 216 wrote to memory of 2320	216	cmd.exe	91
PID 216 wrote to memory of 1240	216	cmd.exe	92
PID 216 wrote to memory of 1240	216	cmd.exe	92
PID 216 wrote to memory of 3080	216	cmd.exe	97
PID 216 wrote to memory of 3080	216	cmd.exe	97
PID 3080 wrote to memory of 3272	3080	Windows-Graphics-Loader.exe	98
PID 3080 wrote to memory of 3272	3080	Windows-Graphics-Loader.exe	98
PID 3080 wrote to memory of 2088	3080	Windows-Graphics-Loader.exe	101
PID 3080 wrote to memory of 2088	3080	Windows-Graphics-Loader.exe	101
PID 2088 wrote to memory of 1456	2088	cmd.exe	103
PID 2088 wrote to memory of 1456	2088	cmd.exe	103
PID 2088 wrote to memory of 5084	2088	cmd.exe	104
PID 2088 wrote to memory of 5084	2088	cmd.exe	104
PID 2088 wrote to memory of 804	2088	cmd.exe	107
PID 2088 wrote to memory of 804	2088	cmd.exe	107
PID 804 wrote to memory of 2920	804	Windows-Graphics-Loader.exe	108
PID 804 wrote to memory of 2920	804	Windows-Graphics-Loader.exe	108
PID 804 wrote to memory of 1284	804	Windows-Graphics-Loader.exe	110
PID 804 wrote to memory of 1284	804	Windows-Graphics-Loader.exe	110
PID 1284 wrote to memory of 856	1284	cmd.exe	112
PID 1284 wrote to memory of 856	1284	cmd.exe	112
PID 1284 wrote to memory of 4968	1284	cmd.exe	113
PID 1284 wrote to memory of 4968	1284	cmd.exe	113
PID 1284 wrote to memory of 3924	1284	cmd.exe	115
PID 1284 wrote to memory of 3924	1284	cmd.exe	115
PID 3924 wrote to memory of 3792	3924	Windows-Graphics-Loader.exe	116
PID 3924 wrote to memory of 3792	3924	Windows-Graphics-Loader.exe	116
PID 3924 wrote to memory of 4724	3924	Windows-Graphics-Loader.exe	118
PID 3924 wrote to memory of 4724	3924	Windows-Graphics-Loader.exe	118
PID 4724 wrote to memory of 4064	4724	cmd.exe	120
PID 4724 wrote to memory of 4064	4724	cmd.exe	120
PID 4724 wrote to memory of 3532	4724	cmd.exe	121
PID 4724 wrote to memory of 3532	4724	cmd.exe	121
PID 4724 wrote to memory of 3856	4724	cmd.exe	122
PID 4724 wrote to memory of 3856	4724	cmd.exe	122
PID 3856 wrote to memory of 1720	3856	Windows-Graphics-Loader.exe	123
PID 3856 wrote to memory of 1720	3856	Windows-Graphics-Loader.exe	123
PID 3856 wrote to memory of 3256	3856	Windows-Graphics-Loader.exe	125
PID 3856 wrote to memory of 3256	3856	Windows-Graphics-Loader.exe	125
PID 3256 wrote to memory of 3220	3256	cmd.exe	127
PID 3256 wrote to memory of 3220	3256	cmd.exe	127
PID 3256 wrote to memory of 396	3256	cmd.exe	128
PID 3256 wrote to memory of 396	3256	cmd.exe	128
PID 3256 wrote to memory of 4256	3256	cmd.exe	129
PID 3256 wrote to memory of 4256	3256	cmd.exe	129
PID 4256 wrote to memory of 1460	4256	Windows-Graphics-Loader.exe	130
PID 4256 wrote to memory of 1460	4256	Windows-Graphics-Loader.exe	130
PID 4256 wrote to memory of 1796	4256	Windows-Graphics-Loader.exe	132
PID 4256 wrote to memory of 1796	4256	Windows-Graphics-Loader.exe	132
PID 1796 wrote to memory of 4688	1796	cmd.exe	134
PID 1796 wrote to memory of 4688	1796	cmd.exe	134
PID 1796 wrote to memory of 1240	1796	cmd.exe	135
PID 1796 wrote to memory of 1240	1796	cmd.exe	135
PID 1796 wrote to memory of 3820	1796	cmd.exe	137
PID 1796 wrote to memory of 3820	1796	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DiscordXploit.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordXploit.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3100
- C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KGANyZpbGN82.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2320
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1240
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fzVeigDYo6YX.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2088
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1456
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5084
      - C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\I9Tstbh85uPi.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4968
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pfNC08HmQufc.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4064
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3532
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HoJJ6vxcmR6u.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:396
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ULcG6X01y7eL.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1240
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3820
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KHm74pd6S8sw.bat" "
        15⤵
        
        PID:3412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2008
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4684
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sVbOaOVwJHHf.bat" "
        17⤵
        
        PID:1820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1272
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1824
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1480
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CDI5Z4cfWbxL.bat" "
        19⤵
        
        PID:3580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4624
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1700
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5064
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F7wzKv6D9B8r.bat" "
        21⤵
        
        PID:364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3592
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3468
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3724
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ez0VaYvBzq1V.bat" "
        23⤵
        
        PID:2708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4428
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1760
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2040
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OrWJHb8gGoop.bat" "
        25⤵
        
        PID:432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2184
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5048
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1996
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M8N0GAZw5YDG.bat" "
        27⤵
        
        PID:1184
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2504
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1752
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5icInXXDhhSh.bat" "
        29⤵
        
        PID:2316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1824
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows-Graphics-Loader.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5icInXXDhhSh.bat

Filesize
224B

MD5
92fa54cd06c11f74b0ef9cdd5d21454e

SHA1
4a484a81604dbe5e9c496cd4b1fe6323eb0a48bc

SHA256
4585de9abc91c231d673e48d9a1573bbdd0bd3a3d749379c610d47f6d4b989cc

SHA512
5cbde6e609ae6fd0cad7929c77e653600a0885b678d984f3eaf32961982fb93f44cfd9b8ef2d464825af9b9cbfdcd21c213739278802933d7349023d7705c626

Download Submit
C:\Users\Admin\AppData\Local\Temp\CDI5Z4cfWbxL.bat

Filesize
224B

MD5
6c066c65db17e57ad8437d380719dd7c

SHA1
1eff36ed8618ccb1ce4c62bafb7e365dbfccf9f1

SHA256
6e174123fc7ccf134f4f4b306105b3b27831dbd320d05fd1555a0ee169a421c6

SHA512
9349e930db0c16e34445aaab1106686a1754f23927bb15bf7bd186bbda0702700610ce085b3cb510b390ecf33beeb3dcae2351a4f2dc29959c8f35039fc630cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ez0VaYvBzq1V.bat

Filesize
224B

MD5
2e336b974e1e46a0b244593cf17946ed

SHA1
202abe4bff9d4a14eb49fb25d24b6397745ae29d

SHA256
38f2a2cca1b2bf84d0766f4c814afd5ce6e46b9f00be5151d07d31fae93fa554

SHA512
878bf608718a0703e8ad5d19d194ddc0719fff564cdeeec120aeac11be6090b73d3ead7563c0b9a9174a62683049b8d394cc3cd81883ac7658896ffe4652e0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\F7wzKv6D9B8r.bat

Filesize
224B

MD5
3dcec2472250bd7df646441c41acb48f

SHA1
812a826bd4292cdcb1e31de4f0c57c1be06470b0

SHA256
e4977ba2785c623384fdd40923a90178c9d34e4281a6c89d28c1e1de6d03ad0e

SHA512
30b6b25b6a39836403a8a40c71220ae566c59f92d5b8cc0f3a329efca8b618cc8a9901a008ea569608bc09d107f5e24d52b57d9a7051aff7cce050cfb488f157

Download Submit
C:\Users\Admin\AppData\Local\Temp\HoJJ6vxcmR6u.bat

Filesize
224B

MD5
e7fd84887dcf1877e0696f1432fdee40

SHA1
82a312898231128d852fb79109fdd7958f9bed83

SHA256
b287c2b3f3a2d4f10f566778fd11aca0c1d9305a54d76c2bf2a7bab97e9b6980

SHA512
aa52064d09df92c936c77e1aa1e97a884d07bfe6feb02526ad31777e11048fcd8ab52ac3d92585d75afc0cf7f97e9ae05df8e4eb20a92c8ffdf20a1a3647a83e

Download Submit
C:\Users\Admin\AppData\Local\Temp\I9Tstbh85uPi.bat

Filesize
224B

MD5
dfec232c5e9ccbbafca59a4552f77958

SHA1
c363fc5a9000c779c9e7161328f7ae6a086a807a

SHA256
fbdf9c46ca2074d961cc944bd2887753a54b7fd49d5b5815d03bbcbc155fbc82

SHA512
f3efb6077a638409854ef0fa3bdbaa0656a96a340613740394ad24e0b32962a88becb3580528e0dfb00e6909a7ff2bd75272107b2818abbea8cc5e3f7b4c8430

Download Submit
C:\Users\Admin\AppData\Local\Temp\KGANyZpbGN82.bat

Filesize
224B

MD5
d964ecfa994bd82ae89eeed5a2d0a763

SHA1
42a3fe2740e6436db040251e8bdd129c2ec94a3d

SHA256
ba79e75e97b0f685776dc5a4fa85a4d12f9f8f03c16f26414a98ecdd5a7fc49c

SHA512
8572ee7455b104510644b75491b1099df271af99938d1a510b823dbe67a8816bd2d59b1419cdd91d94624a5dab780b4de0f499a8a1f26215b497919d0924bba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\KHm74pd6S8sw.bat

Filesize
224B

MD5
cd6fc3a58cf840fd5a6c65f1ccd84fa2

SHA1
9364717ad9dfac8b12753f74f43fb01db655dfc1

SHA256
78b766984d739b20a531eb564655558cbe5c945cf4d11fa01af0a2b7eb69a2ee

SHA512
68a49a2620dd780909466421830931123b44e46321a7a54d25decddd00daf756a82db55ee4a324dedc84ed8c8094cc1dddaa9deee7324876068234b1d9609190

Download Submit
C:\Users\Admin\AppData\Local\Temp\M8N0GAZw5YDG.bat

Filesize
224B

MD5
9c67a3771988176a523dea26fc0c8897

SHA1
2dda14694675b084c89bbf3e69b84fedfb3c94d5

SHA256
585cbbbd9ae1f480d2a200c0d265eb2cee1ac782fd48df6e9e5c2077278c88ae

SHA512
a23d648e77e9429c30eec8463b06d1a50cbd833005c718635f1c906d9af1f36371dfe7106df18168b154a75320f3a0a06e616b259b79ab1e0825fcfe6b3cfc4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OrWJHb8gGoop.bat

Filesize
224B

MD5
3bc8aae41fa2eaff2eb3a78e8e6b80ce

SHA1
0754144f1b52d980ac410faa5a112218021545e8

SHA256
7dacbaf4a864e15f0bb134f5085e5b61a64852bd431840c5cee6f1a59ed78692

SHA512
42edc2604061ae66cd6c4954213d08df756b73dcc590ab791c9910d9f45361eea1fcae3ed8ab2028dd5a41ce18bf2fc9a6b074b2d9c32a4ddfe20764d7ebddc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ULcG6X01y7eL.bat

Filesize
224B

MD5
f0a72219fdd42138369c37a7bcc85db3

SHA1
296822fc775a43fea5ea6e7eb0771d092721a78e

SHA256
1ecfef6f2f269e85b7ffcca79b8f3352fbc8df4d57661d58d270237b1f3edbc0

SHA512
68d6d0f5f9609866f10e6aa8b54e665711f108971f840626930edd63189e82f16d11c768abb7a992c9c8fc0598de73d0bfe61e3a5a8ae465e3cbc27cfbfd86ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\fzVeigDYo6YX.bat

Filesize
224B

MD5
274d7eb4ce7d9fda4d10ffaf11ac7a7b

SHA1
d97eb17e9c8d9a1044498701c3c78b3d8d41c1f4

SHA256
6a929eb0cbced67ad05aecff3b06edfe395af631c7e86017856039af35c0f095

SHA512
6ebdc3b0907020a200f8e2c8b6b999e9d3bd4acb7560061da96a1ac73d825f6f7580d3894b145cf17c813259dd12d8066471d457034977d93a7cb75e467a1ac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\pfNC08HmQufc.bat

Filesize
224B

MD5
8eeaee65b4414e9342792981784b474a

SHA1
ae5b7af5376a7e7e2cee5c085a37617e35bf4575

SHA256
b4149eb6f994b3104ed94c238b921744d77c427850e3468a0875ba7b58dd76ac

SHA512
744b6a27acab28d325056f6449e384c061b083df4a7306ebcb1c7f9678f74de23f72cce9c071566b9f8724eb4c800fae1027f1b747b96b4e6e2446bb7d3c73a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\sVbOaOVwJHHf.bat

Filesize
224B

MD5
538f8481ae51e14b9ef3440f69cda113

SHA1
5be64aa860179d3d42cd44cf90fb221624da6ff0

SHA256
02e470737cb39fafb8c7fa6f2981547fc84809b937f2bc8bd58131fc32e377bd

SHA512
7f868c5960166cf2daff7b346de53fa14a4f9205a5684ef1b40ea15e88364b8cc58c1dd000a8c469e0414c49d183ea9d237ba8b20f9dfd311acee6e67859febd

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe

Filesize
3.3MB

MD5
95da0645204d22bd9daf4e337ebeeaaa

SHA1
58182d8cf8e83335a5b7312d0d4af79f4bd64212

SHA256
ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682

SHA512
9257076c55b3cc6100f3299766bf7bf0be1e0b330c1cadca1d7ca46ff859e4afefeff3635fc15811cc2c7d6debd2fcb808cf5f96314c681b1dbc32d2a7305f9e

Download Submit
memory/3500-0-0x00007FFE58A43000-0x00007FFE58A45000-memory.dmp

Filesize
8KB

Download
memory/3500-9-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download
memory/3500-2-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download
memory/3500-1-0x0000000000EE0000-0x0000000001228000-memory.dmp

Filesize
3.3MB

Download
memory/4516-18-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download
memory/4516-13-0x000000001D820000-0x000000001D8D2000-memory.dmp

Filesize
712KB

Download
memory/4516-12-0x000000001D710000-0x000000001D760000-memory.dmp

Filesize
320KB

Download
memory/4516-11-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download
memory/4516-10-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads